Lecture 13 is about limiting what agents can access and do. The slides open with five real incidents, sort them into four threat models (malicious user, prompt injection, agent error, improper means), then give four layers of defense: red teaming and safety training, sandboxes and credential brokering, monitoring, and safety evaluation. The easiest point to miss: hiding the API key does not stop an agent from misusing the access behind it.
Graham Neubig uses OpenHands, which he leads, to explain framework design: how coding agents evolved from HumanEval, SWE-bench and Devin to 2026's long-running, interruptible, parallel work; the parts of the Software Agent SDK (LLM, tools, conversation, condenser, workspace, confirmation policy); the single- vs. multi-agent trade-off; local vs. cloud and four interfaces (IDE, GUI, CLI, integrations); automations wired to issues and PRs; and revising skills from past trajectories.
On October 7, Perplexity open-sourced two ColBERT-style multimodal embedding models (0.6B and 9B, MIT license) that keep one 128-dim vector per token, score with MaxSim, and search PDF page images directly. The 9B scores 92.4% on MADQA (self-reported, with a Gemini 3.5 Flash agent); the cost is an index that grows with document length.
An 83-page paper from Wavestone AI Lab dissects 11 coding harnesses, including Claude Code, Codex CLI, Gemini CLI and OpenClaw. Across roughly 4 million lines of code, none imports a general-purpose agent framework and none retrieves code with vector embeddings. If you are building or choosing an agent, you can follow the paper's 18 recommendations and start from one bash tool and one while loop.
Cursor engineer Lauren Tan (poteto) says she merges roughly 2,000–2,500 PRs a month, a self-reported figure no one has audited. Her method is three moves: build a verification skill first, turn repeated mistakes into lint and type constraints, and sample-review after merge. The method transfers if your domain can be verified by code.
Uber runs one MCP Gateway for 800+ MCP servers and 5,000+ tools: a control plane crawls internal APIs into disabled-by-default tools, a data plane handles protocol translation, authorization and redaction, and Omni MCP, Response Projection and Code Mode keep context small at scale.
Pi 1.0 and the experimental Pi Durable package shipped together in early October 2026. Pi Durable turns every model request, tool call and compaction into a task that writes a checkpoint, so a killed process resumes from its last checkpoint; Cloudflare followed with PiHarness on Durable Objects. The key design decision is classifying tools as safe or unsafe to replay.
Agent interviews keep returning to eight topics: the agent loop, structured output, function calling, large tool sets, memory, design trade-offs, MCP versus A2A, and prompt caching. This post strings them into one line (concept, mechanism, how to answer) and corrects when the 2026-07 MCP spec changes actually landed.
Seven LLM engineering topics that come up often in interviews: LoRA/QLoRA and fine-tuning vs RAG, RLHF/DPO/GRPO alignment, inference optimization (PagedAttention gives vLLM 2-4x throughput), sampling and decoding, LLM evaluation, the OWASP LLM Top 10 (2026 edition), and hallucination. Each section covers the concept, the mechanism, and how to answer.
Interview follow-ups usually land on mechanisms: why divide by √d_k, how AdamW differs from Adam plus L2, why a high AUC still isn't shippable. This post walks through concept, mechanism and how to answer, then ends with 3 runnable numpy exercises.
Prompt engineering shapes a single instruction, context engineering decides what the model sees right now, and harness engineering wraps the whole non-deterministic system. Bsharat's 26 principles, Breunig's four context failures, and OpenAI's roughly one-million-line, zero-handwritten-code harness experiment each map to one layer. Evaluation is the piece teams skip most, and it belongs in a CI gate that blocks silent regressions.
Answer RAG interview questions in four steps: the three-stage pipeline, where each stage fails, which of nine variants patches which hole, and the 6 kinds of problems RAG cannot solve. Self-RAG, CRAG and Adaptive-RAG add judgment; Graph RAG and KG-RAG change the index; CAG skips retrieval; Agentic RAG and Reasoning RAG hand decisions to the model.
Read each company's own interview guidance first: Meta now expects candidates to use a built-in AI assistant, while Anthropic defaults to no AI. For question banks, pick ones that cite sources and are still maintained this year, such as the alexeygrigorev field guide, ombharatiya, and alirezadir. Only 2 of the 12 popular repos link sources for their questions, and some keep answers behind a paywall.
Plugin Extensions, announced at DevDay 2026 (Sep 29), let a plugin put a home in the ChatGPT sidebar, a panel beside the conversation, and a viewer for its file types — up to three entrypoints per MCP App. A plugin is now Skill + MCP + external services + UI, which adds a new product question: which capabilities should ship as a plugin an agent can install?
Lecture 7 of CME295 (2025) patches three LLM gaps: RAG fixes knowledge frozen at training time with a two-stage retrieve-then-rerank pipeline; tool calling fixes the inability to act by having a backend execute the function call the model writes; agents chain those calls with ReAct's observe-plan-act loop. The 2026 edition renames it AI Agents and adds context compaction, harness optimization, coding agents, and skills, the biggest rewrite in the course.
The 2026 syllabus for CME295 Lecture 6 (November 6, 2026) lists seven topics. Tool calling, MCP and retrieval were already covered in the 2025 Lecture 7; the genuinely new ones are context compaction, harness optimization, coding agents, and skills/plugins. This pre-lecture edition explains those four using engineering posts from Anthropic and OpenAI, the MCP 2026-07-28 spec, and the Meta-Harness paper.
CME295 is a two-unit Stanford course with no homework; your grade is the midterm and the final, 50% each. The 2025 edition's nine lectures are fully public: videos, slides, and both exams with solutions. The 2026 edition rewrites the agent lecture around context compaction, harnesses, coding agents, and skills, and adds three full lectures on LLM systems, reinforcement learning, and Diffusion LLMs.
The last CME295 lecture packs 128 slides into three parts: an eight-picture recap of the quarter, how Transformers handle images (ViT and two ways to build a VLM), and masked diffusion LLMs that emit several tokens per step, followed by what comes next in research and applications. It is not on the exam; the 2026 edition turns diffusion LLMs into a lecture of their own and refocuses Lecture 9 on multimodality.
The 2026 edition of CME295 gives diffusion LLMs a full lecture (Lecture 8, November 20), with five listed subtopics: continuous, discrete and masked diffusion, training, and inference. This pre-lecture edition works from the original papers (DDPM, D3PM, SEDD, MDLM, LLaDA and others): continuous noise costs about 64x the compute on text, and the [MASK] absorbing state won out; the training objective is a masked cross-entropy weighted by 1/t; the speed comes from filling several positions per step, yet LLaDA's main results decode one token per step, and Fast-dLLM needs a confidence threshold plus an approximate KV cache to reach up to a 27.6x speedup.
CME295 Lecture 3 defines an LLM as a decoder-only next-token predictor, uses MoE to explain why a huge model only touches part of its weights per token, and spends most of its time on the knobs you can turn at generation time: greedy, beam search, top-k, top-p, temperature, guided decoding, plus three prompting techniques (few-shot, chain of thought, self-consistency). The 2026 edition folds this lecture into Lecture 2, prompting is no longer a separate syllabus item but still gets a brief segment in the recording.